Skip to content
0.security0.security0
GitHubWebsite

Project comparison

Cross-project XBOW scores are each project’s public self-reports, run under different forks, models, turn caps, and retry protocols. They are protocol-sensitive and should not be read as a matched-conditions ranking. These are historical comparison figures, not a refreshed survey of each project’s latest release. 0’s row comes from the 2026-05-06 ledger snapshot.

Where the agents sit on XBOW

Section titled “Where the agents sit on XBOW”
AgentScoreModelApproachCost
BoxPwnr97.1% (101/104)Claude / GPT-5 / othersShell-first, best-of-N across ~10 configs (best single model 81.7%)Unknown
Shannon96.15% (100/104)Claude 3-tierWhite-box (reads source), 13-agent~$50/scan
KinoSec92.3% (96/104)Claude Sonnet 4.6Black-box, 50-turn capUnknown (proprietary)
Cyber-AutoAgent84.62% (88/104)Not disclosedSingle meta-agent, self-rewriting promptsUnknown
deadend-cli77.55% (~76/98)Kimi K2.5Single-agent CLI (tested 98/104)$122 / 104
MAPTA76.9% (80/104)GPT-53-role multi-agent$21.38 total
093/95 = 97.9% recorded cohortAzure gpt-5.4Any-success retained-results grouping by model; not established pass@1 or black-box-onlyRecorded ~$0.48/result, $5.20/solved challenge

Two distinctions:

  • Best-of-N ≠ single-config ≠ single-shot. BoxPwnr’s cited number unions configurations. 0’s consolidator also unions successes within each model ID without enforcing one configuration, one attempt, or one target mode. Neither grouping establishes a matched pass@1 comparison. See Methodology.
  • White-box ≠ black-box. Shannon reads source, which lifts the ceiling on challenges with no web-facing vector. Not directly comparable to black-box-only runs.

Implementation differences

Section titled “Implementation differences”
  • Blind verification: an independent agent re-exercises candidates on the verification path. Other workflows retain their own evidence states.
  • Reachability: packages/core/src/triage/reachability.ts uses patterns to assess whether a sink is callable.
  • Scanner agreement: the optional foxguard check compares the same tree (packages/core/src/triage/multi-modal.ts).
  • Cost accounting: the historical cohort records $5.20 per solved challenge; repeat-mode aggregation has limits described in Methodology.

Architecture comparison

Section titled “Architecture comparison”

These results use different models, tools, memory, search strategies, and agent counts. They do not isolate agent count as a cause. 0 uses shell tools and supports concurrent spawn_agents for parallel strategies.

Section titled “Related”